9c0660c2e07db3f74fa60d82d37508f4_JaffaCakes118

General

Target
9c0660c2e07db3f74fa60d82d37508f4_JaffaCakes118
Size 150KB
Sample240610-1jlyjs1frd
SHA256 9775b198e8e595cc47ee21c6904af6618c405975996885d534caf8cb8931cd93
MD5 9c0660c2e07db3f74fa60d82d37508f4
SHA1 1217d5b0a2e7047ed74e46ad0326cd59462fd080
SHA512 b589d7892dcecfb000c1b5a8b1ce206ee506fd327a3b5b9c37df5f1f2a579fd71a2ee48d49a450b639b699f5506882924d1c3e8425473ce4e864e7dff2baea72
SSDEEP 1536:DJlQdApO9tHI/7umNZdQ+1B2zLWIQa4PSj/WAvN3EcyEnOs4wwe:DJOGOHHwu8qTq8UavXjwe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

9c0660c2e07db3f74fa60d82d37508f4_JaffaCakes118

.exe 150KB
out.upx

.exe 210KB

9c0660c2e07db3f74fa60d82d37508f4_JaffaCakes118

SHA256 9775b198e8e595cc47ee21c6904af6618c405975996885d534caf8cb8931cd93
MD5 9c0660c2e07db3f74fa60d82d37508f4
SHA1 1217d5b0a2e7047ed74e46ad0326cd59462fd080
SHA512 b589d7892dcecfb000c1b5a8b1ce206ee506fd327a3b5b9c37df5f1f2a579fd71a2ee48d49a450b639b699f5506882924d1c3e8425473ce4e864e7dff2baea72
SSDEEP 1536:DJlQdApO9tHI/7umNZdQ+1B2zLWIQa4PSj/WAvN3EcyEnOs4wwe:DJOGOHHwu8qTq8UavXjwe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

245664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 253ddf2e649b1e192eea88407825efd1bce360863f33afb3e694945719a91b8d
MD5 bcd57b45ead2c4be2b836fb367a51cff
SHA1 857c77d0d2f1c16fd14c2feef6a2766ce29605a0
SHA512 1eca5e42f9f935c905987c5c775b5e04a86e3d8b58514f1647b373686b6552a5e391b5c5a38705c57e7a3f3b03a758c6cefa74d689d6b54bd7525bb6f8b10f67
SSDEEP 1536:jGC5NCroFQiXZEJUuGzsQouJ1gJcxWGd+oryMm+HLsUg2Bj/WAvN3EcyEnOs4ww:jGOXqUuQsQofOWGd2Mm+HLsUg2tvXjw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

9c0660c2e07db3f74fa60d82d37508f4_JaffaCakes118

PE Signature issue

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

9c0660c2e07db3f74fa60d82d37508f4_JaffaCakes118

PE Signature issue

generic

out.upx

generic